Kubernetes Security

Kubernetes SecurityHow to secure your Kubernetes platform

Johannes M. Scheuermann

Karlsruhe, 09.12.2017

Johannes M. ScheuermannIT Engineering & Operations @ inovex

〉 Software-Defined Datacentres

〉 Infrastructure as Code

〉 Cloud technologies

〉 High Availability & Scalability

〉 Want‘s a Z-Frame

〉 @johscheuer

2

Security

• Security Cake

• Authentication and Authorisation

• Network Policies

• Pod Security Policies

• Admission Controller

• Vault Integration

Security Kubernetes

Security Cake

HW HW HW HW

OS OS OS OS

Platform

Container Container Container Container

Base Base Base Base

App App App App

Secure the Pipeline

Build Test Ship Run

• Secure all components with certificates

• Only talk over TLS

• Disable the insecure port (even on localhost)

• Disable anonymous authentication• Or at least restrict it to uncritical resources

• Since 1.7 Kubernetes supports an Audit Log

Focus on the Platform

How to build ”the” platform

• RBAC (Role Based Access Control)

• ABAC (Attribute Based Access Control)

• WebHook

• Certificates

• Token (JWT à https://jwt.io)

Authentication and Authorisation

RBAC (example)

(Cluster)Role

Subject

(Cluster)Rolebinding

Network Policies

• Since 1.6

• Ingress policies

• Egress policies (1.8)

• Network segmentation (distributed firewall)

• CNI plugin must support it

Network Policies

• DENY all traffic to an application

• LIMIT traffic to an application

• DENY all non-whitelisted traffic in a namespace

• DENY all traffic from other namespaces

• ALLOW traffic from other namespaces

• ALLOW traffic from external clients

Network Policies (example)

PodSecurityPolicies

• Needs to be explicitly activated• Let you define what’s allowed• There must be a default policy• Activating “runAsNonRoot” will break many things• Only activate if needed (multi-tenant)• Can be combined with RBAC

Pod Security Policies

• Volumes• RunAsUser• AllowedCapabilities• Privileged• HostNetwork / HostPorts• readOnlyRootFilesystem

Pod Security Policies (example)

Admission Controller(s)

• Intercepts request to the Kubernetes API

• (Can) Perform modifications

• Many default controllers exists

• You can also write your own

Admission Controller(s)

• DenyEscalatingExec

• ImagePolicyWebhook

• NodeRestriction

• PodSecurityPolicy

• SecurityContextDeny

• ServiceAccount

Admission Controller (example)

Vault

Vault Integration (CA)

Vault

Node

Master

1.) Auth (AppRoleID)2.) Issue certificate

Policies

etcd

• Since 0.9 Kubernetes auth backend

• Solves only the challenge of authentication

• Secret must be fetched• Sidecare/init container

• Integrates with ServiceAccounts

Vault Integration (secret store)

• Open artifact metadata API

• Pluggable (multiple providers)

• ACL for the metadata

• Query-ability

• Integrates with Kubernetes

Grafeas

• Service Mesh

• Policy Enforcement (L4/L7)

• Integrated CA

• Transparent TLS

• Routing

• Language/Platform agnostic

Istio

Conclusions

• Many possibilities to make your cluster more secure

• Each with it’s benefits and drawbacks

• Generally à Security means (hard) work

• Depends on your Use Case what to use

• Play around with and get a feeling (in a playground)

Conclusions

27

We are hiring!

www.inovexperts.com

Q&A

• https://kubernetes.io/docs/admin/admission-

controllers

• https://kubernetes.io/docs/concepts/policy/pod-

security-policy

• https://kubernetes.io/docs/concepts/services-

networking/network-policies

Further reading

• https://grafeas.io

• https://istio.io

• https://ahmet.im/blog/kubernetes-network-policy

• https://github.com/kubernetes/examples/tree/master/

staging/podsecuritypolicy/rbac

Further reading

Johannes M. Scheuermanninovex GmbH

Johannes.scheuermann@inovex.de

CC BY-NC-ND inovex.de +JohannesScheuermann

github.com/johscheuer

@johscheuer youtube.com/inovexGmbH